 (defn request-headers
   "Create a set of request headers to use for interaction with the Keycloak
    REST API. This allows us to reuse the same token for multiple requests."
-  ([{:keys [openid-config credentials connection-manager] :as k}]
-   (request-headers k {}))
-  ([{:keys [openid-config credentials connection-manager]}
-    {:keys [timeout] :as req-opts}]
+  ([{:keys [openid-config credentials connection-manager] :as keycloak}]
+   (request-headers keycloak {}))
+  ([{:keys [openid-config credentials connection-manager]} req-opts]
    (let [params (merge {:grant_type "client_credentials"} credentials)
-         req-opts (-> (select-keys req-opts [:timeout])
-                      (assoc :form-params params :connection-manager connection-manager))]
+         req-opts (merge {:form-params params :connection-manager connection-manager} req-opts)]
      (when-let [access-token (-> (client/post (get openid-config "token_endpoint") req-opts)
                                  :body
                                  json/decode

          (println (format "Tried to promote user: %s" user-id))
          (lib/internal-server-error))))))


(defn do-demote-user-from-admin
  [{:keys [api-root] :as keycloak} tenant author-claims user-id]
  (if (= (get author-claims "sub") user-id)


  The Keycloak groups are on the form /akvo/lumen/demo/admin, to simplify  we
  remove the leading /akvo/lumen and return paths as demo/admin."
  [{:keys [api-root user-id-cache connection-manager] :as keycloak} email]
  (when-let [headers (request-headers keycloak)]
    (let [req-opts {:headers headers :connection-manager connection-manager}]
      (when-let [user-id (lookup-user-id req-opts api-root user-id-cache email)]
        (->> (client/get (format "%s/users/%s/groups" api-root user-id) req-opts)
             :body
             json/decode
             (reduce (fn [paths {:strs [path]}]
                       (conj paths (subs path 12)))
                     #{}))))))


;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
